The analysis of push notifications and the measurement of their effectiveness are carried out on the basis of the users’ explicitexplicit consent from users, which is given when they agree to receive push notifications. Users may object to the analysis and performance measurement by unsubscribing from the push notifications. Unfortunately, it is not possible to withdraw consent for the analysis and performance measurement separately; Legal basis: Consent (Art. 6(1), first sentence, point a) of the GDPR).

Video conferences, online meetings, webinars and screen sharing

We use platforms and applications from other providers (hereinafter referred to as “conference platforms”) for the purpose of conducting video and audio conferences, webinars and other types of video and audio meetings (hereinafter collectively referred to as “conferences”). When selecting conference platforms and their services, we comply with the statutory requirements.

Data processed by conference platforms: When participants take part in a conference, the conference platforms process the participants’ personal data listed below. The scope of the processing depends, on the one hand, on what data is required in the context of a specific conference (e.g. provision of login details or real names) and which optional details are provided by the participants. In addition to processing for the purpose ofthe conference, participants’ data may also be processed by the conference platforms for security purposes or to optimise the service. The data processed includes personal details (first name, surname), contact details (email address, telephone number), login details (access codes or passwords), profile pictures, details of professional position/role, the IP address of the internet connection, details of the participants’ end devices, their operating system, browser and its technical and language settings, information on the content of communications, i.e. chat messages as well as audio and video data, as well as the use of other available functions (e.g. polls). The content of communications is encrypted to the extent technically provided by the conference providers. If participants are registered as users on the conference platforms, then further data may be processed in accordance with the agreement with the respective conference provider.

Logging and recordings: Should text entries, participation results (e.g. from polls) and videoor audio recordings are logged, participants will be informed of this transparently in advance and, where necessary, asked for their consent.

Data protectionmeasures for participants: Please refer to the privacy notices of the conference platforms for details regarding the processing of your data and select the security and data protection settings that best suit your needs within the conference platform settings. Please also ensure that your data and privacy are protected in the background of your recording for the duration of a video conference (e.g. by informing housemates, locking doorsand, where technically possible, using the background blurring function). Links to the conference rooms and access details must not be passed on to unauthorised third parties.

Information on legal bases: Where, in addition to the conference platforms, we also process users’ data and ask users for their consent to the use of the conference platforms or specific functions (e.g. consent to the recording of conferences), the legal basis for the processing is this consent. Furthermore, our processing may be necessary to fulfil our contractual obligations (e.g. in participant lists, when summarising meeting outcomes, etc.). In &other respects, users’ data is processed on the basis of our legitimate interests in efficient and secure communication with our communication partners.

  • Types of data processed: Master data (e.g. names, addresses); contact details (e.g. email, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Communication partners; users (e.g. website visitors, users of online services); Persons depicted.
  • Purposes of processing: Provision of contractual services and customer service; contact enquiries and communication; office and organisational procedures.
  • Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR).

Further information on processing operations, procedures and services:

Application process

The application process requires applicants to provide us with the data necessary for their assessment and selection. The information required is set out in the job description or, in the case of online forms, in the details provided there.

Generally, the required details include personal information, such as their name, address, contact details and evidence of the qualifications required for a post. Upon request, we are also happy to provide further details on what information is required.

Thusprovided, applicants can submit their applications to us using an online form &. The data is transmitted to us in encrypted form using state-of-the-art technology. Applicants may also send us their applications via email ü. However, please note that emails are generally not sent in encrypted form over the internet. Whilst emails are usually encrypted whilst in transit, they are not encrypted on the servers from which they are sent and received. We are therefore unable to accept any responsibility ü

For the purposes of candidate sourcing, the submission of applications and the selection of candidates, we may, in accordance with legal requirements, utilise applicant tracking, or recruitment software, as well as platforms and services provided by third parties.

Applicants are welcome to contact us regarding the method of submitting their application or to send their application by post.

Processing of special categories of data: Where, as part of the recruitment process, special categories of personal data within the meaning of Article 9(1) of the GDPR (e.g. health data, such as severely disabled status or ethnic origin) are requested from applicants so that the controller or the data subject can exercise their rights and fulfil their obligations arising from labour law and the law on social security and social protection, such data shall be processed in accordance with Article 9( 2(b) of the GDPR; in the case of the protection of the vital interests of applicants or other individuals in accordance with Article 9(2)(c) of the GDPR; or for the purposes of preventive healthcare or occupational medicine, for the assessment of the employee’semployee’s fitness for work, for medical diagnosis, for healthcare or social care provision or treatment, or for the management of systems and services in the healthcare or social care sector in accordance with Article 9( (2)(h) of the GDPR. Where the provision of special categories of data is based on voluntary consent, such data shall be processed on the basis of Article 9(2)(a) of the GDPR.

Deletion of data: The data provided by applicants may, in the event of a successful application, be further processed by us for the purposes of the employment relationship. Otherwise, should the application for a vacancy be unsuccessful, the applicants’ data will be deleted. The applicants’ data will also bedeleted if an application is withdrawn, which applicants are entitled to do at any time. Subject to a valid withdrawal by the applicant, deletion shall take place at the latest after a period of six months has elapsed, so that we can answer any follow-up questions regarding the application and fulfil our obligations to provide evidence under the regulations on equal treatment of applicants. Invoices for any travel expenses will be archived in accordance with in accordance with tax regulations.

Inclusion in a candidate pool: Inclusion in a candidate pool, where offered, is subject to consent. Applicants are informed that their consent to inclusion in the talent pool is voluntary, has no influence on the current application process, and that they may withdraw their consent at any time with future effect.

  • Types of data processed: Master data (e.g. names, addresses); contact details (e.g. email, telephone numbers); content data (e.g. entries in online forms); applicant data (e.g. personal details, postal and contact addresses, documents relating to the application and the information contained therein, such as cover letters, CVs, certificates, as well as further information regarding a specific position or information provided voluntarily by applicants about themselves or their qualifications).
  • Data subjects: Applicants.
  • Purposes of processing: Recruitment process (establishment and any subsequent implementation, as well as possible subsequent termination of the employment relationship).
  • Legal bases: Recruitment process as a pre-contractual or contractual relationship (Article 6(1)(b) of the GDPR).

Newsletters and electronic notifications

We send out newsletters, emails and other electronic notifications (hereinafter “newsletters”) only with the consent of the recipients or where permitted by law. Where the content of asubscription to the newsletter, its contents are specifically described; these are decisive for the user’s consent. Furthermore,otherwise, our newsletters contain information about our services and our organisation.

To subscribe to our newsletters, it is generally sufficient to provide your email address. We may, however,, however, ask you to provide a name, so that we can address you personally in the newsletter, or further details, provided these are necessary for the purposes of the newsletter.

Double opt-in procedure: Subscription to our newsletter generally takes place via a so-called double opt-in procedure. This means that, after subscribing, you will receive an email asking you to confirm your subscription. This confirmation is necessary to ensure that no one can subscribe using someone else’s email address. Subscriptions to the newsletter are logged in order to provide evidence of the subscription process in accordance with legal requirements. This includes storing the time of registration and confirmation, as well as the IP address. Any changes to your data stored with the mailing service provider are also logged.

D&Deletion and restriction of processing: We may store unsubscribed email addresses for up to three years on the basis of our legitimate interests before we delete themin order to be able to provide evidence of consent previously given. The processing of this data is limited to the purpose of potentially defending against claims. An individual request for erasure may be made at any time, provided that the prior existence of consent is confirmed at the same time. In the event of obligations to permanently comply with objections, we reserve the right to store the email address in a block list (so-called ‘blocklist’) solely for this purpose .

The registration process is logged on the basis of our legitimate interests for the purpose of verifying that it has been carried out correctly. Where we commission a service provider to send emails, this is done on the basis of our legitimate interests in an efficient and secure delivery system.

Content:

Information about us, our services, promotions and offers.

  • Types of data processed: Master data (e.g. names, addresses); contact details (e.g. email, telephone numbers); meta/communication data (e.g. device information, IP addresses); usage data (e.g. websites visited, interest in content, access times).
  • Data subjects: Communication partners; users (e.g. website visitors, users of online services).
  • Purposes of processing: Direct marketing (e.g. by email or post); audience measurement (e.g. access statistics, identification of returning visitors); conversion measurement (measuring the effectiveness of marketing measures); profiles containing user-related information (creation of user profiles).
  • Legal bases: Consent (Art. 6(1), first sentence, point (a) of the GDPR); Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).
  • Right to object (opt-out): You may unsubscribe from our newsletter at any time, i.e. withdraw your consent or object to receiving further issues. You will find a link to unsubscribe from the newsletter either at the end of each newsletter or you may otherwise use one of the contact options listed above, preferably by email.

Further information on processing procedures, methods and services:

  • Measuring open and click-through rates: The newsletters contain a so-called ‘web beacon’, i.e. a pixel-sized file that is retrieved from our server when the newsletter is openedfrom our server or, if we use a mailing service provider, from their server. As part of this retrieval, technical information – such as details about your browser and system, as well as your IP address and the time of retrieval – is first collected. This information is used to improve our newsletter technically, based on the technical data or the target groups and their reading behaviour, determined by their location (which can be identified using the IP address) or the times of access. This analysis also includes determining whether the newsletters are, when they are opened and which links are clicked. This information is linked to individual newsletter recipients and stored in their profiles until they are deleted. We use these analyses to identify our users’ reading habits and tailor our content to them or send different content according to our users’ interests. The measurement of open rates and click-through rates, as well as the storage of the measurement results in users’ profiles and their further processing, are carried out on the basis of the users’ consent. Unfortunately, it is not possible to withdraw consent for performance measurement separately; in this case, the entire newsletter subscription must be cancelled or objection must be raised. In this instance, the stored profile information will be deleted; Legal basis: Consent (Art. 6(1), first sentence, point (a) of the GDPR).
  • Google Analytics: Measuring the success of email campaigns and creating user profiles, stored for up to two years; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6(1), first sentence, point (a) of the GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Privacy policy: https://policies.google.com/privacy; Data Processing Agreement: https://business.safety.google/adsprocessorterms; Standard contractual clauses (guaranteeing the level of data protection when processing in third countries): https://business.safety.google/adsprocessorterms; Option to object (opt-out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Settings for the display of adverts: https://adssettings.google.com/authenticated; Further information: https://privacy.google.com/businesses/adsservices (types of processing and data processed).
  • Mailchimp: email delivery and email marketing platform; service provider: Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA; Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) GDPR); Website: https://mailchimp.com; Privacy policy: https://mailchimp.com/legal/; Data Processing Agreement: https://mailchimp.com/legal/; Standard contractual clauses (guaranteeing the level of data protection when processing in third countries): Included in the data processing agreement; Further information: Specific security measures: https://mailchimp.com/help/Mailchimp-european-data-transfers/.

Marketing communications via email, post, fax or telephone

We process personal data for the purposes of marketing communications, which may be carried out via various channels, such as email, telephone, post or fax, in accordance with the statutory requirements.

Recipients have the right to withdraw their consent at any time or to object to marketing communications at any time.

Following withdrawal of consent or an objection, we will retain the data necessary to prove the previous legitimacy of contacting you or sending communications for up to up to three years after the end of the year in which the withdrawal or objection took place, on the basis of our legitimate interests. The processing of this data is limited to the purpose of potentially defending against claims. On the basis of the legitimate interest in permanently honouring users’ revocation or objection, we also store the data necessary to prevent further contact (e.g. depending on the communication channel, the email address, telephone number or name).

  • Types of data processed: Master data (e.g. names, addresses); contact details (e.g. email, telephone numbers).
  • Data subjects: Communication partners.
  • Purposes of processing: Direct marketing (e.g. by email or post).
  • Legal bases: Consent (Art. 6(1), first sentence, point (a) of the GDPR); Legitimate interests (Art. 6(1), sentence 1(f) of the GDPR).

Prize draws and competitions

We process the personal data of participants in prize draws and competitions only in compliance with the relevant data protection regulations, insofar as such processing is contractually necessary for the provision, organisation and administration of the prize draw, the participants have consented to the processing, or the processing serves our legitimate interests (e.g. to ensure the security of the prize draw or to protect our interests against misuse through the possible collection of IP addresses when prize draw entries are submitted).

Should participants’ entries be published in connection with the competitions (e.g. as part of a vote or the presentation of competition entries or winners, or in reports on the competition), we would like to point out that participants’ names may also be published in this context. Participants may object to this at any time.

If the competition takes place on an online platform or a social network (e.g. Facebook or Instagram, hereinafter referred to as “online platform”), the terms of use and privacy policies of the respective platforms shall also apply. In such cases, we would like to point out that we are responsible for the information provided by participants in connection with the prize draw and that any enquiries regarding the prize draw should be addressed to us.

Participants’ data will be deleted as soon as the prize draw or competition has ended and the data is no longer required to inform the winners or because enquiries regarding the prize draw are to be expected. As a general rule, participants’ data will bedeleted no later than 6 months after the end of the prize draw. Data relating to the winners maybe retained for longer, for example to answer enquiries regarding the prizes or to fulfil the prize obligations; in which case the retention period depends on the nature of the prize and may, for example, be up to three years for goods or services, in order to be able to deal with warranty claims. Furthermore, participants’ data may be stored for longer, e.g. in the form of reports on the prize draw in online and offline media.

Where data has also been collected for other purposes in connection with the prize draw, its processing and retention period are governed by the privacy notice relating to that use (e.g. in the case of signing up for a newsletter as part of a prize draw).

  • Types of data processed: Master data (e.g. names, addresses); content data (e.g. entries in online forms); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Participants in prize draws and competitions.
  • Purposes of processing: Conducting prize draws and competitions.
  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1), first sentence, point (b) of the GDPR).

Surveys and questionnaires

We carry out surveys and questionnaires in order to collect information for the respective stated survey or questionnaire. The surveys and questionnaires we carry out (hereinafter “questionnaires”) are analysed anonymously. Personal data is processed only to the extent necessary for the provision and technical implementation of the surveys (e.g. processing the IP address to display the survey in the user’s browser or using a cookie to enable the survey to be resumed).

  • Types of data processed: Contact details (e.g. email, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Communication partners; participants.
  • Purposes of processing: Feedback (e.g. collecting feedback via an online form).
  • Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR).

Web analytics, monitoring and optimisation

Web analytics (also referred to as ‘reach measurement’) serves to analyse visitor traffic to our online offering and may include behaviour, interests or demographic information about visitors, such as age or gender, in the form of pseudonymous values. With the help of reach analysis, we can, for example, identify at what times our online service, or its functions or content, is used most frequently, or encourage repeat visits. We can also identify which areas require optimisation.

In addition to web analytics, we may also use testing methods to, for example, test and optimise different versions of our online offering or its components.

Unless otherwise stated below, profiles – i.e. data aggregated for a specific usage session – may be created for these purposes, and information may be stored in a browser, or on a device, and retrieved from it. The data collected includes, in particular, the webpages visited and the elements used on them, as well as technical details such as the browser and computer system used, and information on usage times. Where users have consented to the collection of their locationto us or to the providers of the services we use, location data may also be processed.

Users’ IP addresses are also stored. However, we use an IP masking procedure (i.e. pseudonymisation by truncating the IP address) to protect users. Generally speaking, no plaintext user data (such as email addresses or names) is stored in the context of web analytics, A/B testing and optimisation, but rather pseudonyms. This means that neither we nor the providers of the software used know the actual identity of the users, but only the information stored in their profiles for the purposes of the respective procedures.

  • Types of data processed: Usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: users (e.g. website visitors, users of online services).
  • Purposes of processing: Remarketing; target group identification (determining target groups relevant for marketing purposes or other content delivery); reach measurement (e.g. access statistics, identification of returning visitors); profiles containing user-related information (creation of user profiles); tracking (e.g. interest-based/behavioural profiling, use of cookies); provision of our online service and user-friendliness.
  • Security measures: IP masking (pseudonymisation of the IP address).
  • Legal bases: Consent (Art. 6(1), first sentence, point (a) of the GDPR).

Further information on processing operations, procedures and services:

  • Google Analytics: Web analytics, audience measurement and measurement of user flows; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6(1), first sentence, point (a) of the GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Privacy policy: https://policies.google.com/privacy; Data Processing Agreement: https://business.safety.google/adsprocessorterms; Standard contractual clauses (guaranteeing data protection standards when processing in third countries): https://business.safety.google/adsprocessorterms; Right to object(opt-out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Settingssettings for the display of adverts: https://adssettings.google.com/authenticated; Further information: https://privacy.google.com/businesses/adsservices (Types of processing and the data processed).
  • Google Analytics 4: We use Google Analytics to carry out user analysis based on a pseudonymous user identification number. This identification number does not contain any personally identifiable data, such as names or email addresses. It serves to assign analytical information to a device in order to identify which content users have accessed within one or more usage sessions, which search terms they have used, whether they have revisited the content or interacted with our online service. The time of use and its duration are also stored, as well as the sources from which users have accessed our online service and technical details of their devices and browsers. In doing so, pseudonymous user profiles are created using information from the use of various devices, for which cookies may be used. In Analytics, data on geographical location is provided at a higher level by capturing the following metadata via IP lookup: ‘City’ (and the derived latitude and longälatitudes of the city), ‘continent’, ‘country’, ‘region’, ‘subcontinent’ (and their ID-based equivalents). To ensure the protection of user data in the EU,, Google receives and processes all user data via domains and servers within the EU. Users’ IP addresses are not logged and are, by default,truncated by the last two digits. The K&IP address truncation takes place on EU servers for EU users. Furthermore, all sensitive data collected from users in the EU is deletedbefore it is collected via EU domains and servers; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6(1), first sentence, point (a) of the GDPR); Website: https://marketingplatform.google.com/intl/de/about/analytics/; Privacy policy: https://policies.google.com/privacy; Data Processing Agreement: https://business.safety.google/adsprocessorterms/; Standard contractual clauses (guaranteeing data protection standards for processing in third countries): https://business.safety.google/adsprocessorterms; Right to object (opt-out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Settings for the display of adverts: https://adssettings.google.com/authenticated; Further information: https://privacy.google.com/businesses/adsservices (Purconditions of processing and the data processed).
  • Google Analytics in consent mode: In consent mode, users’ personal data is processed by Google for measurement and advertising purposes, depending on the users’ consent. Consent is obtained from users as part of our online services. If users’ consent is entirely lacking, the data is processed only at an aggregated (i.i.e. not attributed to individual users and summarised). If consent covers only statistical measurement, no users’ personal data is processed for the purpose of displaying adverts or measuring advertising success (so-called ‘conversion’); Legal basis: Consent (Art. 6(1), first sentence, point (a) of the GDPR); Website: https://support.google.com/analytics/answer/9976101?hl=de.
  • Target audience segmentation with Google Analytics: We use Google Analytics to display adverts placed within Google’s advertising services and those of its partners only to those userswho have previously shown an interest in our online offering or who exhibit certain characteristics (e.g. interests in specific topics or products, determined on the basis of the webpages visited), which we transmit to Google (so-called “Remarketing-or “Google Analytics Audiences”). We also use Remarketing Audiences to ensure that our adverts match users’ potential interests; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6(1), first sentence, point (a) of the GDPR); Website: https://marketingplatform.google.com; Legal basis: https://business.safety.google/adsprocessorterms/; Privacy policy: https://policies.google.com/privacy; Data processing agreement: https://business.safety.google/adsprocessorterms/; Further information: Types of processing and data processed: https://privacy.google.com/businesses/adsservices; Data processing terms for Google advertising products and standard contractual clauses for data transfers to third countries: https://business.safety.google/adsprocessorterms.

Online marketing

We process personal data for the purposes of online marketing, which includes, in particular, the marketing of advertising space or the display of advertising and other content (collectively referred to as "content") based on users’ potential interests, as well as measuring their effectiveness.

For these purposes, so-called user profiles are created and stored in a file (known as a "cookie") or similar methods are used, by means of which information relevant to the display of the aforementioned content is stored. This information may include, for example, content viewed, websites visited, online networks used, as well as communication partners and technical details such as the browser used, the computersystem, as well as details on usage times and the functions utilised. Where users have consented to the collection of their location data, this may also be processed.

Users’ IP addresses are also stored. However, we use available IP masking methods (i.e. pseudonymisation by truncating the IP address) to protect users. Generally, within the framework of online marketing procedures, no plaintext user data (such as email addresses or names) is stored; instead, pseudonyms are used. This means that neither we nor the providers of the online marketing procedures know the actual identity of the users, but only the information stored in their profiles.

The information in the profiles is usually stored in cookies or by means of similar methods. These cookies can generally be read later on other websites that use the same online marketing process, and are analysed for the purpose of displaying, as well as supplemented with further data and stored on the server of the online marketing provider.

In exceptional cases, plain text data may be associated with the profiles. This is the case, for example, when users are members of a social network whose online marketing methods we use and the network links the users’ profiles with the aforementioned information. Please note that users may enter into additional agreements with the providers, for example by giving their consent during registration.

We generallyonly have access to aggregated information regarding the success of our adverts. However, as part of so-called conversion tracking, we can checkwhich of our online marketing methods have led to a so-called conversion, i.e. for example, the conclusion of a contract with us. Conversion tracking is used solely to analyse the success of our marketing measures.

Unless otherwise stated, please assume that the cookies used will be stored for a period of two years.

  • Types of data processed: Content data (e.g. entries in online forms); usage data (e.e.g. webpages visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses); Event data (Facebook) (“Event data” refers to data that may, for example, be transmitted by us to Facebook via Facebook pixels (via apps or by other means)and which relate to individuals or their actions; the data includes, for example, details of visits to websites, interactions with content, functions, app installations, product purchases, etc.; the eventdata is processed for the purpose of creating target audiences for content and advertising (Custom Audiences); event data does not include the actual content (such as comments posted), nor any logininformation or contact details (i.e. no names, email addresses or telephone numbers). Event data is deleted by Facebook after a maximum of two years; the target groups created from this data are deleted upon deletion of our Facebook account).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Audience measurement (e.g. access statistics, identification of returning visitors); tracking (e.g. interest-based/behavioural profiling, use of cookies); conversion measurement (measuring the effectiveness of marketing measures); target group formation; marketing; profiles containing user-related information (creation of user profiles); target group identification (identifying target groups relevant for marketing purposes or other content delivery); provision of our online service and user-friendliness; click tracking.
  • Security measures: IP masking (pseudonymisation of the IP address).
  • Legal bases: Consent (Art. 6(1), first sentence, point (a) of the GDPR); Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR).
  • Right to object (opt-out): We refer you to the privacy notices of the respective providers and the options for objecting(so-called ‘opt-out’). If no explicit opt-out option has been provided, you have the option, on the one hand, disable cookies in your browser settings. However, this may restrict certain functions of our online service. We therefore also recommend the following opt-outoptions, which are summarised and tailored to the respective regions: a) Europe: https://www.youronlinechoices.eu. b) Canada: https://www.youradchoices.ca/choices. c) USA: https://www.aboutads.info/choices. d) Cross-regional: https://optout.aboutads.info.

Further information on processing procedures, methods and services:

  • Facebook Pixel and audience targeting (Custom Audiences): With the help of the Facebook Pixel (or comparable functions for transmitting event data or contact information via interfaces in apps), Facebook is able, on the one hand,to identify visitors to our online service as a target group for the display of adverts (so-called ‘Facebook Ads’). Accordingly, we use the Facebook Pixel to ensure that the Facebookto be displayed only to those users on Facebook and within the services of Facebook’s partner organisations (the so-called “Audience Network” https://www.facebook.com/audiencenetwork/) to those users who have also shown an interest in our online offering or who exhibit certain characteristics (e.g. an interest in specific topics or products, as indicated by the web pages they have visited), which we transmit to Facebook (so-called ‘Custom Audiences’). We also use the Facebook Pixel to ensure that our Facebook adverts match users’ potential interests and do not come across as intrusive. Furthermore, the Facebook Pixel enables us to track the effectiveness of Facebookadvertisements for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Facebook advert (so-called ‘conversion tracking’); Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal basis: Consent (Art. 6(1), first sentence, point (a) of the GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/about/privacy; Further information: Users’ event data, i.e. behavioural and interest-based information, is processed for the purposes of targeted advertising and audience targeting on the basis of the joint controller agreement (“Addendum for Data Controllers”, https://www.facebook.com/legal/controller_addendum). Joint controllership is limited to the collection by and transfer of data to Meta Platforms Ireland Limited, a company based in the EU. Further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, particularly with regard to the transfer of data to the parent company, Meta Platforms, Inc., in the USA (on the basis of the Standard Contractual Clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.).
  • Facebook adverts: Placement of advertson the Facebook platform and analysis of advertising results; Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal basis: Consent (Art. 6(1), first sentence, point (a) of the GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/about/privacy; Option to object (opt-out): We refer to the privacy and advertising settings in users’ profiles on the Facebook platform, as well as to Facebook’s consent procedures and contact options for exercising the right to access data and other data subject rights, as set out in Facebook’s Privacy Policy; Further information: Users’ event data, i.e. behavioural and interest data, is processed for the purposes of targeted advertising and audience targeting on the basis of the agreement üon joint controllership (“Supplement for Controllers”, https://www.facebook.com/legal/controller_addendum). Joint controllership relatesto the collection of and transfer of data to Meta Platforms Ireland Limited, a company based in the EU. Further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, in particular with regard to the transfer of data to the parent company Meta Platforms, Inc. in the USA (on the basis of the standard contractual clauses agreed between Meta Platforms Ireland Limited and Meta Platforms, Inc.)
  • Google Ads and conversion tracking: We use the online marketing service ‘Google Ads’ to place adverts on the Google advertising network (e.g. in search results, in videos, on websites, etc.), so that they are shown to users who are presumed to have an interest in the adverts (so-called ‘conversion’). We also measure the conversion rate of the adverts. However, we are only provided with the anonymous total number of users who have clicked on our advert and been redirected to a page tagged with a so-called ‘conversion tracking tag’. We ourselves do not, however, receive any information that could be used to identify users; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Consent (Art. 6(1), first sentence, (a) of the GDPR); Website: https://marketingplatform.google.com; Privacy policy: https://policies.google.com/privacy; Further information: Types of processing and data processed: https://privacy.google.com/businesses/adsservices; Data processing terms between data controllers and standard contractual clauses for data transfers to third countries: https://business.safety.google/adscontrollerterms.
  • Enhanced conversions for Google Ads: If customers click on our Google adverts and subsequentlygo on to use the advertised service (known as a ‘conversion’), the data entered by the user – such as their email address, name, home address or telephone number – may be transmitted to Google ü. The hash values are then matched against users’ existing Google accounts in order to better analyse and improve users’ interaction with the adverts (e.g. clicks or views) and, consequently, their performance; Legal basis: Consent (Art. 6(1), first sentence, point (a) of the GDPR); Website: https://support.google.com/google-ads/answer/9888656.
  • Instagram advertisements: Placement of advertisements within the Instagram platform and analysis of advertising results; Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal basis: Consent (Art. 6(1)(a) GDPR); Website: https://www.instagram.com; Privacy policy: https://instagram.com/about/legal/privacy; Right to object (Opt-out): We refer to the privacy and advertising settings in users’ profiles on the Instagram platform, as well as to Instagram’s consent procedures and contact options for exercising the right to access data and other data subject rights as set out in Instagram’s privacy policy&; Further information: User event data, i.e. behavioural and interest data, is processed for the purposes of targeted advertising and audience targeting on the basis of the agreement on joint controller status (“Supplement forControllers”, https://www.facebook.com/legal/controller_addendum). Joint controllership is limitedto the collection by and transfer of data to Meta Platforms Ireland Limited, a company based in the EU. Further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, in particular with regard to the transfer of data to the parent company, Meta Platforms, Inc., in the USA (on the basis of the Standard Contractual Clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.).
  • UTM parameters: Analysis of sources and user actions based on an extension of web addresses linking to us with an additionalparameter, the ‘UTM’ parameter. For example, a UTMparameter “utm_source=platformX &utm_medium=video” tells us that a person clicked on the link on platform X within a video. The UTM parameters provide information about the source of the link, the medium used (e.g. social media, website, newsletter), the type of campaign or the content of the campaign (e.g. post, link, image and video). Using this information, we can, for example, assess our online visibility or the effectiveness of our campaigns; Legal basis: Legitimate interests (Art. 6(1), first sentence (f) of the GDPR).

Customer reviews and rating processes

We take part in review and rating processes in order to evaluate, optimise and promote our services. If users ürate us via the relevant rating platforms or schemes, or provide feedback in any other way, the providers’ General Terms and Conditionsor Terms of Use and the privacy policies of the providers shall also apply. As a rule, submitting a rating also requires registration with the respective providers.

To ensure that those submitting reviews have actually used our services, we transmit the necessary data relating to the customer and the service used to the respective review platform with the customer’s consent (including; name, email address and order number or item number). This data is used solely to verify the user’s authenticity.

  • Types of data processed: Contract data (e.g. subject matter of the contract, term, customer category); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Customers; users (e.g. website visitors, users of online services).
  • Purposes of processing: Feedback (e.g. collection of feedback via online form); marketing.
  • Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR).

Further information on processing operations, procedures and services:

  • Reviewwidget: We incorporate so-called ‘review widgets’ into our online offering. A widget is a functional and content element integrated into our online offering that displays variable information. It may, for example, take the form of a seal or similar element, sometimes also referred to as a ‘badge’ . Whilst the relevant content of the widget is displayed within our online service, it is retrieved at that moment from the servers of the respective widget provider. This is the only way to ensure that the current content is always shown, particularly the most recent rating. To this end, a data connection must be established from the website accessed within our online serviceto the widget provider’s server, and the widget provider receives certain technical data (access data, including the IP address) which is necessary for the widget’s content to be delivered to the user’s browser. Furthermore, the widget provider receives informationthat users have visited our online service. This information may be stored in a cookie and used by the widget provider to identify which online services participating in the rating scheme have been visited by the user. The information may be stored in a user profile and usedused for advertising or market research purposes; Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR).
  • Google Customer Reviews: Service for gathering and/or displaying customer satisfaction and customer opinions; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); Terms and Conditions: https://support.google.com/merchants/topic/7259129?hl=de&ref_topic=7257954; Privacy Policy: https://policies.google.com/privacy; Further information: When collecting customer reviews, an identification number and the date and time of the transaction being reviewed are processed;; in the case of review requests sent directly to customers, the customer’s email address and details of their country of residence, as well as the review details themselves, are processed; Further details on the types of processing and the data processed: https://privacy.google.com/businesses/adsservices; Data processing terms for Google advertising products: Information on the services, data processing terms between data controllers and standard contractual clauses for data transfers to third countries: https://business.safety.google/adscontrollerterms.

Social media presence

We maintain an online presence on social media platforms and, in this context, process user data in order to communicate with users active on these platforms or to provide information about us.

We would like to point out that, in doing so, user data may be processed outside the European Union. This maymay entail risks for users, as it could, for example, make it more difficult to enforce users’ rights.

Furthermore, users’ data within social networks is generally processed for market research and advertising purposes. For example,, for example, user profiles can be created based on usage behaviour and the resulting interests of users. These user profiles can in turn be used, for example, to display advertisements both within and outside the networks, which are presumed to correspond to users’ interests. For these purposes, cookies are usually stored on users’ computers, in which users’ usage behaviour and interests are recorded. Furthermore, data may also be stored in the usage profiles regardless of the devices used by the users (particularly if users are members of the respective platforms and are logged in to them).

For a detailed description of the respective forms of processing and the options for objecting(opt-out), please refer to the privacy policiesand information provided by the operators of the respective networks.

In the case of requests for information and the exercise of data subjects’ rights, we would also point out that these are most effectively exercised with the providers themselves. Only the providers have access to users’ data in each case and can take appropriate action directly and provide information. Should you nevertheless require assistance, you may contact us.

  • Types of data processed: Contact details (e.g. email, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Enquiries and communication; feedback (e.g. collection of feedback via online forms); marketing.
  • Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR).

Further information on processing procedures, procedures and services:

  • Instagram: social network; service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); Website: https://www.instagram.com; Privacy policy: https://instagram.com/about/legal/privacy.
  • Facebook pages: Profiles within the Facebook social network – We are jointly responsible with Meta Platforms Ireland Limited for the collection (but not the further processing) of data from visitors to our Facebook page (the so-called “fan page”). This data includes information on the types of content that users view or interact with, or the actions they take (see ‘Things you and others do and provide’ in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices used by users (e.g. IP addresses, operating system, browser type, language settings, cookie data; see ‘Device information’ in the Facebook Data Policy: https://www.facebook.com/policy). As explained in the Facebook Data Policy under ‘How do we use this information?’, Facebook also collects and uses information to provide analytics services, known as ‘Page Insights’, to page administrators, so that they can gain insights into how people interact with their pages and the content associated with them. We have entered into a specific agreement with Facebook (“Information on Page Insights”, https://www.facebook.com/legal/terms/page_controller_addendum), which specifically sets out the security measures Facebook must observe and in which Facebook has agreed to fulfil the rights of data subjects (i.e. users can, for example, request information ordeletion requests directly to Facebook). Users’ rights (in particular the rights to access, deletion, objection and complaint to the competent supervisory authority) are not restricted by the agreements with Facebook. Further information can be found in the “Page Insights Information” (https://www.facebook.com/legal/terms/information_about_page_insights_data); Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6(1)( 1(f) of the GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/about/privacy; Standard contractual clauses (guaranteeing an adequate level of data protection when processing in third countries): https://www.facebook.com/legal/EU_data_transfer_addendum; Further information:Joint controller agreement: https://www.facebook.com/legal/terms/information_about_page_insights_data. Joint controllership is limited to the collection by and transfer of data to Meta Platforms Ireland Limited, a company based in the EU. Further processing of the data is the sole responsibility of Meta Platforms Ireland Limited, in particular with regard to the transfer of data to the parent company, Meta Platforms, Inc., in the USA (on the basis of the Standard Contractual Clauses concluded between Meta Platforms Ireland Limited and Meta Platforms, Inc.).
  • Facebook Groups: Interest groups within the Facebook social network – We use the ‘Groups’ feature on the Facebook platform to create interest groups within which Facebook users can interact with one another or with us and exchange information. In doing so, we process the personal data of our group users to the extent necessary for the purpose of group use and moderation. Our guidelineswithin the groups may contain further guidelines and information regarding the use of the respective group. This data includes first names and surnames, as well as published or privately shared content, and details regarding group membership status or group-related activities, such asjoining or leaving a group, as well as the timestamps relating to the aforementioned data. We also draw your attention to the processing of user data by Facebook itself. This data includes information on the types of content that users view or interact with, or the actions they take (see ‘Things you and others do and share’ in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices used by users (e.g. IP addresses, operating system, browser type, language settings, cookie data; see ‘Device information’ in the Facebook Data Policy: https://www.facebook.com/policy). As explained in the Facebook Data Policy under ‘How do we use this information?’, Facebook also collects and uses information to provide analytics services, known as “Insights”, to group administrators so that they can gain insights into how people interact with their groups and the content associated with them; Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/about/privacy.
  • Facebook events: Event profiles within the Facebook social network – We use the ‘Events’ feature on the Facebook platform to publicise events and dates, as well as to get in touch with users (participants and those interested) and to exchange information. In doing so, we process the personal data of users of our event pages to the extent necessary for the purpose of the event page and its moderation. This data includes first names and surnames, as well as content published or privately shared content, as well as details regarding attendance status and the timestamps associated with the aforementioned data. Furthermore, we draw your attention to the processing of user data by Facebook itself. This data includes information on the types of content that users view or interact with, or the actions they take (see ‘Things you and others do and share’ in the Facebook Data Policy: https://www.facebook.com/policy), as well as information about the devices used by users(e.g. IP addresses, operating system, browser type, language settings, cookie data; see ‘Device information’ in the Facebook Data Policy: https://www.facebook.com/policy). As explained in the Facebook Data Policy under ‘How do we use this information?’, Facebook also collects and uses information to provide analytics services, known as ‘Insights’, to event organisers, so that they can gain insights into how people interact with their event pages and with the associated content; Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); Website: https://www.facebook.com; Privacy policy: https://www.facebook.com/about/privacy.
  • YouTube: Social network and video platform; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Privacy policy: https://policies.google.com/privacy; Option to object (opt-out): https://adssettings.google.com/authenticated.

Plugins, embedded functions and content

We incorporate functional and content elements into our online service, which are sourced from the servers of their respective providers (hereinafter referred to as “third-party providers”). These may include, for example, graphics, videos or city maps (hereinafter collectively referred to as “content”).

This integration always requires the third-party providers of this content to process the user’s IP address, as they would be unable to send the content to the user’s browser without it. The IP address is thereforerequired for the display of this content or these functions. We endeavour to use only such content where the respective providers use the IP address solely for the purpose of delivering the content. Third-party providers may also use so-called pixeltags (invisible graphics, also known as ‘web beacons’) for statistical or marketing purposes. These ‘pixel tags’ canenable information, such as visitor traffic on the pages of this website, to be analysed. The pseudonymous information may also be stored in cookies on the user’s device and may include, amongst other things, technical information about the browser and operating system, referring websites, the time of visit, as well as further details regarding use of our online service, and may also be linked to such information from other sources.

  • Types of data processed: Usage data (e.g. webpages visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses); master data (e.g. names, addresses); contact details (e.g. email addresses, telephone numbers); content data (e.g. entries in online forms); location data (information on the geographical position of a device or a person); event data (Facebook) (“Event data” refers to data which, for example, via Facebook Pixel (via apps or by other means) and which relate to individuals or their actions; the data includes, for example, details of visits to websites, interactions with content, features, app installations, K&product views, etc.; Event Data is processed for the purpose of creating target audiences for content and advertising (Custom Audiences); Event Data does not include the actual content (such as comments posted), no logininformation or contact details (i.e. no names, email addresses or telephone numbers). Event data is deleted by Facebook after a maximum of two years; the target groups created from this data are deleted upon the deletion of our Facebook account).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Provision of our online offering and user-friendliness; provision of contractual services and customer service; marketing; profiles containing user-related information (creation of user profiles).
  • Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); consent (Art. 6(1), first sentence, point (a) of the GDPR).

Further information on processing procedures, methods and services:

  • Integration of third-party software, scripts or frameworks (e.g. jQuery): We integrate software into our online offering that we retrieve from other providers’ servers (e.g. function libraries that we use to display our online offering or to enhance its user-friendliness). In doing so, the respective providers collect the users’ IP addresses and may use these forthe purpose of transmitting the software to the user’s browser, for security purposes, and for the analysis and optimisation of their service. - We integrate software into our online service that we retrieve from servers operated by other providers (e.g. functional libraries that we use to display our online service or enhance its user-friendliness). In doing so, the respective providers collect users’ IP addresses and may process them for the purposes of transmitting the software to users’ browsers, for security purposes, as well as to analyse and optimise their services; Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR).
  • Facebook plugins and content: Facebook social plugins and content – This may include, for example, content such as images, videos or text, as well as buttonsthat allow users to share content from this online service on Facebook. The list and appearance of the Facebook Social Plugins can be viewed here: https://developers.facebook.com/docs/plugins/ – We are jointly responsible with Meta Platforms Ireland Limited for the collection or receipt, as part of a transfer (but not the further processing), of “event data”which Facebook collects via the Facebook social plugins (and content embedding functions) running on our website, or which it receives as part of a transfer, for the following purposes: a) Displaying content and advertising information that corresponds to users’ presumed interests; b) Sending commercial and transaction-related messages (e.g. contacting users via Facebook Messenger); c) improving ad delivery and personalising features and content (e.g. improving the identification of which content or advertising information is likelyare likely to match users’ interests). We have entered into a specific agreement with Facebook (“Addendum for Controllers”, https://www.facebook.com/legal/controller_addendum), which specifically sets out the security measures Facebook must observe (https://www.facebook.com/legal/terms/data_security_terms) and in which Facebook has agreed to fulfil data subjects’ rights (i.e. users can, for example, submit enquiries or deletion requests directly to Facebook). Please note: Where Facebook provides us with metrics, analyses and reports (which are aggregated, i.e. contain no information on individual users and are anonymous to us), this processing does not take place within the framework of joint controllership, but on the basis of a data processing agreement (“Data Processing Terms”, https://www.facebook.com/legal/terms/dataprocessing) , the “Data Security Terms” (https://www.facebook.com/legal/terms/data_security_terms) and, with regard to processing in the USA, on the basis of standard contractual clauses (“Facebook-EU Data Transfer Addendum”, https://www.facebook.com/legal/EU_data_transfer_addendum). Users’ rights (in particular to access, erasure, objection and the right to lodge a complaint with the competent supervisory authority) are not restricted by the agreements with Facebook; Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal basis: Consent (Article 6(1)(a) of the GDPR); Website: https://www.facebook.com; Privacy Policy: https://www.facebook.com/about/privacy.
  • Google Fonts (hosted on our own server): fonts (“Google Fonts”) for the purpose of a user-friendly presentation of our online service; service provider: Google Fonts are hosted on our server; no data is transmitted to Google; Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR).
  • Google Maps: We integrate maps from the “Google Maps” service provided by Google. The data processed may include, in particular, IP addresses and location data ; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6(1), first sentence, (f)) of the GDPR); Website: https://mapsplatform.google.com/; Privacy policy: https://policies.google.com/privacy.
  • Google Maps APIs and SDKs: Interfaces to Google’s map and location services, which, for example, enable the completion of address entries, location determination, distance calculations or the provision of supplementary information on locations and other places; Service provider: Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); Website: https://mapsplatform.google.com/; Privacy policy: https://policies.google.com/privacy.
  • Instagram plugins and content: Instagram plugins and content - This may include, for example, content such as images, videos or text, and buttons that enable users to share content from this online service on Instagram. - We are jointly responsible with Meta Platforms Ireland Limited for the collection or receipt, as part of a transfer (but not the further processing), of ‘event data’ which Facebook collects via Instagram functions (e.g. content embedding functions) carried out on our online service, or which it receives as part of a transfer, for the following purposes: a) displaying content and advertising information that corresponds to the presumedcorrespond to users’ presumed interests; b) Delivery of commercial and transaction-related messages (e.g. contacting users via Facebook Messenger); c) Improving ad delivery and personalising features and content (e.g. improving the identification of which content or advertising information is presumedcorrespond to users’ interests). We have entered into a specific agreement with Facebook (“Addendum for Data Controllers”, https://www.facebook.com/legal/controller_addendum), which specifically sets out the security measures Facebook must observe (https://www.facebook.com/legal/terms/data_security_terms) and in which Facebook has undertaken to fulfil the rights of data subjects (i.e. users can, for example, submit enquiries or deletion requests directly to Facebook). Note: Where Facebook provides us with metrics, analyses and reports (which are aggregated, i.e. do not contain any information on individual users and are anonymous to us), this processing does not take place within the framework of joint control, but on the basis of a data processing agreement (“Data Processing Terms”, https://www.facebook.com/legal/terms/dataprocessing), the “Data Security Terms” (https://www.facebook.com/legal/terms/data_security_terms) and, with regard to processing in the USA, on the basis of standard contractual clauses (“Facebook–EU Data Transfer Addendum”, https://www.facebook.com/legal/EU_data_transfer_addendum). Users’ rights (in particular the right to access, erasure, objection and the right to lodge a complaint with the competent supervisory authority) are not restricted by the agreements with Facebook; Service provider: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://www.instagram.com; Privacy policy: https://instagram.com/about/legal/privacy.
  • reCAPTCHA: We incorporate the "reCAPTCHA" to determine whether entries (e.g. in online forms) are made by humans and not by automated machines (so-called "bots"). The data processed may include IP addresses, information on operating systems, devices or browsers used, language settings, location, mouse movements, keystrokes, time spent on web pages, previously visited web pages, interactions with reCAPTCHA on other websites, cookies in certain circumstances, and the results of manual verification processes (e.g. answering questions or selecting objects in images) may be included. Data processing is carried out on the basis of our legitimate interest in protecting our online service from abusive automated crawling and spam; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); Website: https://www.google.com/recaptcha/; Privacy policy: https://policies.google.com/privacy; Right to object (opt-out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Settings for the display of adverts: https://adssettings.google.com/authenticated.
  • YouTube videos: Video content; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); Website: https://www.youtube.com; Privacy policy: https://policies.google.com/privacy; Right to object (opt-out): Opt-out plugin: https://tools.google.com/dlpage/gaoptout?hl=de, Settings for the display of adverts: https://adssettings.google.com/authenticated.
  • YouTube videos: Video content; YouTube videos are integrated via a special domain (identifiable by the component ‘youtube-nocookie’) in what is known as ‘Enhanced Privacy Mode’, which means that no cookies relating to user activityin order to personalise video playback. However, information regarding users’ interaction with the video (e.g. remembering the last playback position) may be stored; Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); Website: https://www.youtube.com; Privacy policy: https://policies.google.com/privacy.

Management, organisation and support tools

We use services, platforms and software from other providers (hereinafter referred to as “third-party providers”) for the purposes of organising, managing, planning and delivering our services. When selecting third-party providers and their services, we comply with the statutory requirements.

In this context, personal data may be processed and stored on the servers of third-party providers. This may involve various types of data, which we process in accordance with this privacy policy. This data may include, in particular, users’ master data and contact details, as well as data relating to transactions, contracts, other processes and their contents.

Where users are directed to third-party providers or their software or platforms in the context of communication, business or other relationships with us, the third-party providers may process usage data and metadata for security purposes, to optimise their services or for marketing purposes. We therefore ask that you observe the privacy policies of the respective third-party providers.

  • Types of data processed: Content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Communication partners; users (e.g. website visitors, users of online services).
  • Purposes of processing: Contact enquiries and communication; provision of contractual services and customer service; administrative and organisational procedures; audience measurement (e.g. access statistics, identification of returning visitors); profiles containing user-related information (creation of user profiles).
  • Legal bases: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).

Further information on processing operations, procedures and services:

  • Asana: Project management – organisation and administration of teams, groups, workflows, projects and processes; Service provider: Asana, Inc, 1550 Bryant Street, Suite 200, San Francisco, CA 94103, USA; Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); Website: https://asana.com; Privacy policy: https://asana.com/de/terms#privacy-policy; Data processing agreement: https://asana.com/de/terms#data-processing; Standard contractual clauses (guaranteeing data protection standards when processing in third countries): https://asana.com/de/terms#data-processing.
  • Bitly: URL shortening service and link management platform; Service providers: Bitly, Inc., 139 Fifth Avenue, New York, NY 00000, USA; Bitly: URL shortening service and link management platform; Service providers: Bitly, Inc., 139 Fifth Avenue, New York, NY 00000, USA; Bitly: URL shortening service and link management platform; Service providers: Bitly, Inc., 139 Fifth Avenue, New York, NY 00000, USA; Bitly: URL shortening service and link management platform; Service providers:Service provider: Bitly, Inc., 139 Fifth Avenue, 5th Floor, New York, NY 10010, USA; Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); Website: https://bitly.com; Privacy policy: https://bitly.com/pages/privacy.
  • WeTransfer: Transfer of files via the internet; Service provider: WeTransfer BV, Oostelijke Handelskade 751, Amsterdam, 1019 BW, Netherlands; Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); Website: https://wetransfer.com; Privacy policy: https://wetransfer.com/legal/privacy.

Amendments and updates to the privacy policy

We ask you to keep yourself regularly informed about the content of our privacy policy. We will amend the Privacy Policy as soon as changes to the data processing operations we carry out make this necessary. We will inform you as soon as the changes require any action on your part (e.g. consent) or any other individual notification is required.

Where we provide addresses and contact details of companies and organisations in this privacy policy, please note that these addresses may change over time and we ask that you check the details before making contact.

Rights of data subjects

As a data subject, you have various rights under the GDPR, which arise in particular from Articles 15 to 21 of the GDPR:

  • Right to object: You have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data carried out on the basis of Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions. If your personal data is processedfor the purposes of direct marketing, you have the right to object at any time to the processing of your personal data for the purposes of such marketing; this also applies to profiling insofar as it is related to such direct marketing.
  • Right to withdraw consent: You have the right to withdraw any consent you have given at any time.
  • Right of access: You have the right to request confirmation as toas to whether the relevant data is being processed, and to receive information about this data, as well as further details and a copy of the data, in accordance with the statutory requirements.
  • Right to rectification: In accordance with the statutory requirements, you have the right to request the completion of the data concerning you or the rectification of any inaccurate data concerning you.
  • Right to erasure and restriction of processing: In accordance with the statutory provisions, you have the right to request that data relating to you be erased without delay or, alternatively, in accordance with the statutory provisions, to request a restriction on the processing of the data.
  • Right to data portability: You have the right to receive the data concerning you that you have provided to us, in accordance within accordance with the statutory provisions, in a structured, commonly used and machine-readable format, or to request that such data be transferred to another data controller.
  • Complaints to the supervisory authority: In accordance with the statutory provisions and without prejudice to any other administrative or judicial remedy, you also have the right to lodge a complaint with a data protection supervisory authority,, in particular a supervisory authority in the Member State in which you habitually reside, the supervisory authority for your place of work or the location of the alleged infringement, should you consider that the processing of personal data relating to you infringes the GDPR.
The supervisory authority responsible for us:

Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna

Definitions of Terms

This section provides an overview of the terms used in this privacy notice. Many of the terms are taken from the law and, in particular, in Article 4 of the GDPR. The legal definitions are binding. The explanations below, however, are primarily intended to aid understanding. The terms are listed in alphabetical order.

  • Click tracking: Click tracking enables monitor users’ movements across an entire online service. As the results of these tests are more accurate when users’ interactions can be tracked over a certain period of time (e.g. so that we can determine whether a user is likely to return),cookies are usually stored on users’ computers for these testing purposes.
  • Conversion measurement: Conversion measurement (also known as ‘visit-action analysis’) is a method which can be used to determine the effectiveness of marketing measures. To this end, a cookie is usually stored on users’ devices within the websites on which the marketing measures take place, and then retrieved again on the target webpage. For example, this enables us to track whether the adverts we have placed on other websites have been successful.
  • Personal data: “Personal data” means any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”); a natural person is regarded as identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. a cookie) or to one or more factors specific to the physicalphysical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
  • Profiles containing user-related information: The processing of “profiles containing user-related information”, or “profiles” for short" comprises any form of automated processing of personal data which consists of using such personal data to analyse, evaluate or predict certain personal aspects relating to a natural person (depending on the nature of the profiling, this may include various information concerning demographics, behaviour and interests, such as interaction with websites and their content, etc.), or to predict them (e.g. interests in specific content or products, clicking behaviour on a website or location). Cookies and web beacons are frequently used for profiling purposes.
  • Audience measurement: Audience measurement (also known as web analytics) is used to analyse visitor traffic to an online service and may include the behaviour or interests of visitors in relation to specific information, such as website content. With the help of audience, website owners can, for example, identify at what times visitors access their website and what content they are interested in. This enables them, for example, to better tailor the website’s content to the needs of their visitors. For the purposes of reach analysis,pseudonymous cookies and web beacons are often used to identify returning visitors and thus obtain more accurate analyses of how an online service is used.
  • Remarketing: The terms ‘remarketing’ or ‘retargeting’ are used when, for example, information is recorded for advertising purposes regardingwhich products a user has shown an interest in on a website, in order to remind the user of these products on other websites, e.g. in adverts.
  • Location data: Location data is generated when a mobile device (or another devicewith the technical capabilities to determine a location) connects to a mobile network cell, a Wi-Fi network or similar technical means and location-determination functions. Location data serves to indicate the geographically identifiable position on Earth at which the respective device is located. Location data maybe used, for example, to display map functions or other location-dependent information.
  • Tracking: The term ‘tracking’ is used when users’ behaviour can be tracked across multiple online services. As a rule, information on behaviour and interests relating to the online services used is stored in cookies or on the servers of the providers of tracking technologies (known as ‘profiling’). This information can thenbe used, for example, to display adverts to users that are likely to match their interests.
  • Data controller: The term “data controller” refers to the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
  • Processing: “Processing” means any operation or set of operations which is carried out on personal data, whether or not by automated means. The term is broad and covers virtually any handling of data, be it collection, analysis, storage, Ütransmission or erasure.
  • Target audience creation: The term ‘target group segmentation’ (or ‘Custom Audiences’) is used when target groups are identified for advertising purposes, e.g. the display of advertisements. For example, a user’s interest in certain products or topics on the internet can be used to infer that this user is interested in adverts for similar products or the online shop where they viewed the products. The term “Lookalike Audiences” (or similar target groups) are, in turn, used when content deemed suitable is displayed to users whose profiles or interests are presumed to correspond to those of the users on whose profiles the lookalike audiences were based. Cookies and web beacons are generally used for the purpose of creating Custom Audiences and Lookalike Audiences.
How long is personal data stored?
12 months

To whom is data disclosed?
Data is disclosed to third parties solely for the purposes of fulfilling our business obligations, in order to process and respond to your enquiry. For this purpose, your data will be passed on to Inbox Solutions GmbH (Pretzfelder Straße 7–11, 90425 Nuremberg, Germany), the technical operator of the web chat, and to Sellwerk GmbH & Co. KG (Pretzfelder Straße 7–11, 90425 Nuremberg, Germany) as the intermediary to the company, and to the company you have contacted via the web chat. We use Google Cloud to store your data and chat histories. The data is transferred to and stored on servers located in Frankfurt. Google does not use this data for its own purposes. We use Google Cloud services on the basis of our legitimate interest pursuant to Article 6(1)(f) of the GDPR, in order to be able to provide our services via the technical infrastructure. We have entered into a data processing agreement with Google (https://cloud.google.com/terms/data-processing-terms). In the event that personal data is transferred to the USA, we have entered into EU Standard Contractual Clauses with Google (https://cloud.google.com/terms/data-processing-terms). The EU Standard Contractual Clauses are a generally recognised mechanism for the lawful cross-border transfer of personal data to countries outside the European Economic Area (EEA).

Further information on using the web chat
When you visit the website mittersill.info, the chat widget is loaded as a JavaScript file. No data is transferred before you open the chat. You have two options for opening the web chat:
1. Manually click on the button in the directory listing
2. Manually click on the chat icon at the bottom right of the webpage

The moment you open the web chat, your chat is created as an object in the background, and the chat ID and a token are stored in the browser’s local storage. The ID and token are unique identifiers that enable us to unambiguously recognise your chat (chat ID) and you as a user (token) even when you visit again, and to display any previous chat history. As soon as you return to our website, the chat history is restored using the data stored in local storage. You must open the chat manually. In addition, the history of the web chats is stored. Every message you send is saved. This is to ensure that your chat history can be displayed even if the conversation is continued at a later time, for example, if a company replies to you with a delay. If you receive a message from the company whilst you are no longer online, you will be sent a link via email that takes you back to the chat so that you can continue communicating with the company there. When you click on the link in your email, the chat will open automatically. You can pause the chat at any time; however, your data will not be automatically deleted in this case. If you no longer wish to receive messages from the company (opt-out), simply send the message ‘Stop’ via the web chat. After that, you will no longer receive messages from the company via the chat, nor will you be contacted by email. Your chat history and your data will be automatically deleted 6 months after the ‘Stop’ message. To have your data deleted immediately, please send an email to support@chatwerk.de. Your data and saved chat histories will then be deleted immediately.

Data controller for the Facebook Messenger service:
Facebook Messenger, Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA; the privacy policy is available at facebook.com/about/privacy

Provider responsible for the WhatsApp Messenger service:
WhatsApp Messenger, WhatsApp, Inc., 1601 Willow Road, Menlo Park, California 94025, USA; the privacy policy is available at whatsapp.com/legal/business-policy/

The provider responsible for the Instagram Direct Messages service:
Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; the privacy policy is available at https://help.instagr am.com/519522125107875

Provider responsible for the ChatWerk platform/service:
Inbox Solutions GmbH, Pretzfelder Straße 7, 11, 90425 Nuremberg, Germany. The privacy policy is available at https://chatwerk.de/datenschutzerklaerung/

Information on cookies and data protection

Introduction

In this privacy policy&, we wish to inform you about the types of personal data (hereinafter also referred to as “data”) that we process, the purposes for which we do so, and the extent to which we process it. This privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and, in particular, on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as the “online offering”).

The terms used are gender-neutral.

Date: 12 October 2022

Legal text by Dr Schwenke – please click for further information.

Table of contents

Data Controller

MITTERSILL PLUS TOURISMUS – STANDORTMARKETING- UND PROJEKTENTWICKLUNGS GMBH
Zeller Straße 2
5730 Mittersill
&Austria

Authorised representatives:

Michael Sinnhuber

Email address:

welcome@mittersill.info

Telephone:

+43 (0)6562 40869

Legal notice:

https://www.mittersill.info/de/impressum.html

Overview of data processing

The following overview summarises the types of data processed and the purposes of such processing, and refers to the data subjects.

Types of data processed

  • Master data.
  • Payment data.
  • Location data.
  • Contact details.
  • Content data.
  • Contract data.
  • Usage data.
  • Meta/communication data.
  • Applicant data.
  • Event data (Facebook).

Categories of data subjects

  • Customers.
  • Prospective customers.
  • Communication partners.
  • Users.
  • Applicants.
  • Participants in prize draws and competitions.
  • Businessbusiness and contractual partners.
  • Participants.
  • Persons depicted.

Purposes of processing

  • Provision of contractual services and customer service.
  • Enquiries and communication.
  • Security measures.
  • Direct marketing.
  • Audience measurement.
  • Tracking.
  • Office and organisational procedures.
  • Remarketing.
  • Conversion measurement.
  • Click tracking.
  • Target group segmentation.
  • Management and response to enquiries.
  • Recruitment procedures.
  • Organisation of prize draws and competitions.
  • Feedback.
  • Marketing.
  • Profiles containing user-related information.
  • Target group definition.
  • Provision of our online services and user-friendliness.
  • IT infrastructure.

Relevant legal bases

Below you will find an Üoverview of the legal bases under the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your country of residence or where we are based. Should more specific legal bases apply in individual cases, we will inform you of these in the privacy policy.

  • Consent (Art. 6(1), first sentence, point (a) of the GDPR) – The data subject has given their consent to the processing of their personal data for a specific purpose or for several specific purposes.
  • Performance of a contract and pre-contractual enquiries (Art. 6(1), first sentence, point (b) of the GDPR) – The processing is necessary for the performance of a contract to which the data subject is a party, or for the implementation of pre-contractual measures taken at the data subject’s request.
  • Legal obligation (Art. 6(1), first sentence, (c) GDPR) – The processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR) - Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.
  • Recruitment process as a pre-contractual or contractual relationship (Article 6(1)(b) of the GDPR) - Where, as part of the recruitment process, special categories of personal data within the meaning of Article 9(1) of the GDPR (e.g. health data, such as severe disability status or ethnic origin) are requested from applicants, so that the controller or the data subject may or her to exercise their rights arising from employment law and the law on social security and social protection, and to fulfil their obligations in this regard, their processing is carried out in accordance with Article 9(2)(b) of the GDPR; in the case of the protection of the vital interests of applicants or other individuals, in accordance with Article 9(2)(c) of the GDPR; or forfor the purposes of preventive healthcare or occupational medicine, for the assessment of the employee’s fitness for work, for medical diagnosis, care or treatment in the health or social sector, or for the management of systems and services in the health or social sector in accordance with Article 9(2)(h) GDPR. In the event that special categories of data are provided on the basis of voluntary consent, their processing is carried out on the basis of Article 9(2)(a) of the GDPR.

In addition to the data protection provisions of the General Data Protection Regulation, national data protection regulations in Austria. These include, in particular, the Federal Act on the Protection of Natural Persons with regard to the Processing of Personal Data (Data Protection Act – DSG). The Data Protection Act contains, in particular, specific provisions on the right of access, the right to rectification or erasure, the processing of special categories of personal data, processing for other purposes, and the &transfer, as well as automated decision-making in individual cases.

Security measures

We implement security measures in accordance with statutory requirements, taking into account the state of the art, the costs of implementation and the nature, scope, circumstances and purposes of the processing, as well as the varying likelihoods and severity of the threat to the rights and freedoms of natural persons, to ensure a level of protection appropriate to the risk

These measures include, in particular, ensuring the confidentiality, integrity and availabilityavailability of data by controlling physical and electronic access to the data, as well as the access, input, disclosure and safeguarding of theavailability and their segregation. Furthermore, we have established procedures to ensure that data subjects’ rights are upheld, data is deleted and responses are made to data breaches. Furthermore, we take the protection of personal data into account right from the development or selection of hardware, software and procedures, in accordance with the principle of data protection by design and through privacy-friendly default settings.

IP address truncation:IP addresses are processed by us or by the service providers and technologies we use, and where the processing of a fullIP address is not required, the IP address is truncated (also known as ‘IP masking’). In this process, the last two digits, or the last part of the IP address following a full stop, are removed or replaced with placeholders. TheIP address is intended to prevent or significantly impede the identification of a person on the basis of their IP address.

TLS encryption (https): To protect the data you transmit via our online service, we use TLS encryption. You can recognise connections encrypted in this way by the prefix https:// in your browser’s address bar.

Transfer of personal data

As part of our processing of personal data, it may occur that the data is transferred to other bodies, companies, legally independent organisational units or individuals, or that it is disclosed to them. Recipients of this data may include, forservice providers commissioned to carry out IT tasks or providers of services and content integrated into a website. In such cases, we comply with the statutory requirements and, in particular, conclude appropriate contracts or arrangements designed to protect your data.

Data transfer within the group of companies: We may transfer personal data to other companies within our group of companies or grant them access to this data. Where such disclosure is made for administrative purposes, it is based on our legitimate business and commercial interests, or takes place where it is necessary to fulfilour contractual obligations, or where the data subjects have given their consent or where there is a statutory authorisation.

Data transfer within the organisation: We may transfer personal data to other departments within our organisation or grant them access to this data. Where such transfer is carried out for administrative purposes, the transfer of data is based on our legitimate business and operational interests, or takes place where it is necessaryfulfil our contractual obligations, or where the data subjects have given their consent or where there is a legal basis for doing so.

Data processing in third countries

Where we process data in a third country (i.e. outside the EuropeanUnion (EU) or the European Economic Area (EEA)), or where processing takes place in connection with the use of third-party services or the disclosure or transfer of data to other individuals, bodies or organisations, this is carried out only in accordance with the statutory requirements.

Subject to express consent or where transfer is required by contract or law, we shall only process or allow the data to be processed in third countrieswith a recognised level of data protection, contractual obligations through the European Commission’s so-called standard data protection clauses, where certifications exist, or where binding internal data protection regulations are in place (Articles 44 to 49 of the GDPR, European Commission information page: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de).

Deletion of data

The data we process will be deleted in accordance withstatutory requirements as soon as the consent granted for processing is withdrawn or other authorisations cease to apply (e.g. if the purpose of processing this data no longer applies or it is no longer necessary for that purpose). If the data is not to bebecause it is required for other, legally permissible purposes, its processing will be restricted to those purposes. This means that the data will be blocked and not processed for any other purposes. This applies, for example, to data which must be retained for commercial or tax law reasons, or where its retention is necessary for the establishment, exercise or defence of legal claims, or for the protection of the rights of anothernatural or legal person.

As part of our privacy policy, we may provide users with further information regarding the erasure and retention of data that applies specificallythe respective processing operations.

Use of cookies

Cookies are small text files or other storage markers that store information on end devices and retrieve information from them . For example, to store the login status in a user account, the contents of a shopping basket in an online shop, the content accessed or the functions used on a website. Cookies may also be used for various purposes, e.g.B. to ensure the functionality, security and user-friendliness of online services, as well as to analyse visitor traffic.

Information on consent: We use cookies in accordance with legal requirements. We therefore obtain prior consent from users, unless this is not required by law. In particular, consent is not required if the storage and retrieval of information – including cookies – is absolutely essential in order to provide users with a telemedia service (i.e. our online service) that they have expressly requested. This revocable consent is clearly communicated to users and includes information on the specific use of cookies.

Information on the legal basis under data protection law: The legal basis under data protection law on which we process users’ personal data using cookies dependsdepends on whether we ask users for their consent. If users give their consent, the legal basis for the processing of their data is the consent they have given. Otherwise, the data processed using cookies is processed on the basis of our legitimate interests (e.g. the business operation of our online service and improving its usability) or, where this takes place in the context of fulfilling our contractual obligations, if the use of cookies is necessary to fulfil our contractual obligations. We will explain we process cookies, we explain in this privacy notice or as part of our consent and processing procedures.

Retention period: With regard to storage duration, a distinction is made between the following types of cookies:

  • Temporary cookies (also known as sessionor session cookies): Temporary cookies are deleted at the latest once a user has left an online service and closed their device (e.g. browser or mobile application) .
  • Persistent cookies: Persistent cookies remain stored even after the device has been closed. This allows, for example, the login status to be saved or preferred content to be displayed immediately when the user visits a website again. Similarly, user data collected via cookies may be used for audience measurement. Unless we provide users with explicit information regarding the type and storage duration of cookies (e.g. when seeking consent), users should assume that cookies are persistent and may be stored for up to two years.

General information on withdrawal of consent and objection (opt-out): Users may withdraw the consent they have given at any time and may also object to the processing in accordance with the legal requirements set out in Article 21 of the GDPR. Users may also üvia their browser settings, e.g. by disabling the use of cookies (although this may also restrict the functionality of our online services). An objection to the use of cookies for online marketing purposes can also be lodged via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/.

Further information on processing operations, procedures and services:

  • Processing of cookie data on the basis of consent: We use a cookie consent management procedure, within the framework of which users’ consent to the use of cookies, or to the processing operations and providers specified in the cookie consent management procedure, is obtained and can be managed and withdrawn by the users. In this process, the declaration of consent is stored so that the request for consent does not have to be repeatedand to be able to provide evidence of consent in accordance with the legal obligation. Storage may take place on the server and/or in a cookie (a so-called ‘opt-in’ cookie, or using comparable technologies) in order to be able to associate the consent with a user or their device. Subject to specific information provided by the providers of cookie management services, the following applies: Consent may be stored for up to two years. In this process, a pseudonymous useridentifier is generated and stored along with the time of consent, details of the scope of consent (e.g. which categories of cookies and/or service providers) as well as the browser, operating system and end device used.
Cookie settings

Business services

We process data relating to our contractual and business partners, e.g. customers and prospective customers (collectively referred to as "contractual partners") within the framework of contractual and comparable legal relationships, as well as associated measures and in the context of communication with contractual partners (or on a pre-contractual basis), e.g. to respond to enquiries.

We process this data in order to fulfil our contractual obligations. These include, in particular, the obligations to provide the agreed services, any obligations to update data, and the provision of remedies in the event of warranty claims and other service disruptions. Furthermore, we process the data to safeguard our rights and for the purposes of administrative tasks associated with these obligations, as well as for the organisation of our business. In addition, we process the data on the basis of our legitimate interests in sound andmanagement, as well as in security measures to protect our contractual partners and our business operations from misuse or threats to their data, confidential information, details and rights (e.g. the involvement of telecommunications, transport and other support services, as well as subcontractors, banks, tax and legal advisers, payment service providers or financial authorities). Within the framework of applicable law, we shall only disclose the data of contractual partners to third parties to the extent that this is necessary for the aforementioned purposes or to fulfil legal obligations. Contractual partners shall be informed in this Privacy Notice regarding other forms of processing, e.g. for marketing purposes, are set out in this privacy policy.

We inform contractual partners of the data required for the aforementioned purposes either before or during the data collection process, e.g. in online forms, by means of specific markings (e.g. colours) or symbols (e.g. asterisks, etc.), or in person.

We delete the data once statutory warranty obligations and comparable obligations have expired, i.e. generally after 4 years, unless the data is stored in a customer account, e.g. for as long as it must be retained for statutory. The statutory retention period for documents relevant to tax law, as well as for commercial ledgers, inventories, opening balance sheets, annual financial statements, the working instructions and other organisational documents necessary for understanding these documents, and accounting vouchers is ten years; and for commercial and business correspondence received and copies of commercial and business letters: six years. The period begins at the end of the calendar year in which the last entry was made in the book, the inventory, the opening balance sheet, the annual accounts or the management report were drawn up, the commercial or business letter was received or dispatched, or the accounting document was created, or the record was made, or the other documents were created.

Where we use third-party providers or platforms to provide our services, the terms and conditions and privacy policies of the respective third-party providers or platforms shall apply to the relationship between users and those providers.

  • Types of data processed: Master data (e.g. names, addresses); payment data (e.g. bank details, invoices, payment history); contact details (e.g. email, telephone numbers); contract details (e.g. subject matter of the contract, term, customer category); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: customers; prospective customers; businessbusiness and contractual partners.
  • Purposes of processing: Provision of contractual services and customer service; security measures; contact enquiries and communication; office and organisational procedures; administration and handling of enquiries; conversion measurement (measuring the effectiveness of marketing measures); profiles containing user-related information (creation of user profiles).
  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1), first sentence, point (b) of the GDPR); Legal obligation (Art. 6(1), sentence 1(c) of the GDPR); Legitimate interests (Art. 6(1), first sentence, (f) of the GDPR).

Further information on processing operations, procedures and services:

  • Customer account: Contractual partners may create an account within our online service (e.g. customer or user account, or simply ‘customer account’). Where the registration of a customer account is required, contracting parties will be informed of this, as well as of the details required for registration. Customer accounts are not public and cannot be indexed by search engines. As part of the registration, as well as during subsequent logins and use of the customer account, we store customers’ IP addresses along with the times of access in order to verify registration and prevent any misuse of the customer account. If customersaccount, the data relating to that account will be deleted, unless retention is required for legal reasons. It is the customers’ responsibility to ensure their data is deleted once the account has been; Legal basis: Performance of a contract and pre-contractual enquiries (Art. 6(1), first sentence, point (b) of the GDPR).
  • Customer loyalty programme/loyalty card: We process customers’ data as part of our customer loyalty programme for the purpose of fulfilling the services provided to participating customers under the programme. For this purpose, the information collected from customers and, where necessary, marked as such, are stored in a customer profile. The profile also contains information on the use of the customer loyalty programme and on the utilisation of the associated services and benefits; this information is passed on to third parties (such asB. service providers). Customer profiles are deleted upon termination of participation and archived with the relevant data only to the extent necessary for statutory retention purposes or the fulfilment of statutory (up to 11 years for tax-related information from the end of the year in which it was generated) or contractual claims (up to three years from the end of the year in which participation ended); Legal basis: Performance of a contract and pre-contractual enquiries (Art. 6(1), first sentence, point (b) of the GDPR).
  • Economic analyses and market research: For business management purposes and in order to identify market trends and the preferences of contractual partners and users, we analyse the data available to us relating to business transactions, contracts, enquiries, etc., whereby the group of data subjects may include contractual partners, prospective customers, customers, visitors and users of our online services. The analyses are carried out for the purposes of business evaluation, marketing and market research (e.g. to identify customer groups with different characteristics). In doing so, we may take into account, where available, the profiles of registered users together with their details, e.g. regarding services used,. The analyses are for our own use only and are not disclosed externally, unless they are anonymous analyses based on aggregated, i.e. anonymised, data. Furthermore, we taketake account of users’ privacy and process the data for analytical purposes in a pseudonymous manner wherever possible and, where feasible, anonymously (e.g. as aggregated data); Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR).
  • Shop and e-commerce: We process our customers’ data to enable them to select, purchase or order the chosen products, goods and associated services, as well as to facilitate their payment, delivery and fulfilment. Where this is necessary for the fulfilmentfulfil an order, we engage service providers, in particular postal, freight and delivery companies, to carry out the delivery or fulfilment on behalf of our customers. For the processing of payment transactions, we utilise the services of banks and payment service providers. The required details are identified as such during the ordering process or a comparable purchase transaction and include the information necessary for delivery or provisionand invoicing, as well as contact details to enable us to consult with you if necessary; Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1), first sentence, point (b) of the GDPR).
  • Agency services: We process our clients’ data as part of our contractual services, which include, for example, conceptual and strategic consultancy, campaign planning, software and design development, consultancy or maintenance, the implementation of campaigns and processes, handling, server administration, data analysis, consultancy services and training services; Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1), first sentence, point (b) of the GDPR).
  • Online courses and online training: We process the data of participants in our online courses and online training programmes (collectively referred to as ‘participants’) in order to provide them with our course and training services. The data processed in this context, as well as the nature, scope, purpose and necessity of its processing, are determined by the underlying contractual relationship. The data generally includes details of the courses and services utilised and, where these form part of our service offering, the participants’ personal specifications and results. The forms of processing also include the assessment of performance and the evaluation of our services as well as those of the course and training leaders; Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1), first sentence, point (b) of the GDPR).
  • Events and functions: We process the data of participants in the events, functions and similar activities offered or organised by us (hereinafter collectively referred to as “‘participants’ and ‘events’) in order to enable them to take part in the events and make use of the services or activities associated with their participation. Where, in this context, we process health-related data, religious, political or other special categories of data, this is done within the bounds of public knowledge (e.g. in the case of thematically focused events, or where it serves the purposes of healthcare, safety or is carried out with the consent of the data subjects). The required details are identified as such when concluding a contract, order or similar agreement and comprise the information required for the provision of services and invoicing, as well as contact details to enable any necessary consultations. Where we gain access to information relating to end customers, employees or other individuals, we process such information in accordance with statutory and contractual requirements; Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1), first sentence, point (b) GDPR).

Use of online platforms for marketing and sales purposes

We offer our services on online platforms operated by other service providers. In this context, thethe privacy policies of the respective platforms apply in addition to our privacy policy. This applies in particular with regard to the execution of the payment transaction and the procedures used on the platforms for measuring reach and for interest-based marketing.

  • Types of data processed: Master data (e.g. names, addresses); payment data (e.g. bank details, invoices, payment history); contact details (e.g. email, telephone numbers); Contract data (e.g. subject matter of the contract, term, customer category); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Customers.
  • Purposes of processing: Provision of contractual services and customer service; marketing.
  • Legal bases: Performance of a contractand pre-contractual enquiries (Art. 6(1), first sentence, point (b) of the GDPR); legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR).

Further information on processing operations, procedures and services:

  • Shopify: platform via which e-commerce services are offered and carried out. The services and the processes carried out in connection with them include, in particular, online shops, websites, their offers and content, community features, purchase and payment transactions, customer communication, as well as analysis and marketing; Service provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland; Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); Website: https://www.shopify.de; Privacy policy: https://www.shopify.de/legal/datenschutz.

Payment methods

Within the framework of contractual and other legal relationships, in accordance with statutory obligations or otherwise on the basis of our legitimate interests, we offer data subjects efficient and secure payment options and, for this purpose, engage other service providers in addition to banks and credit institutions (collectivelyreferred to as “payment service providers”).

The data processed by the payment service providers includes master data, such as name and address, bank details, such as account numbers or credit card numbers, passwords, TANs and checksums, as well as details relating to the contract, amounts and. This information is required to carry out the transactions. However, the data entered is processed and stored solely by the payment service providers. This means that we do not receive any account- or credit card-related information, but only information regardingconfirmation or rejection of the payment. Under certain circumstances, the data may be transmitted by the payment service providers to credit reference agencies. The purpose of this transmission is to carry out an identityand creditworthiness checks. In this regard, we refer you to the terms and conditions and privacy policies of the payment service providers.

Payment transactions are subject to theand the privacy notices of the respective payment service providers, which are available on their respective websites or within the transaction applications. We also refer to these for further information and for exercising your rights of withdrawal, access and other data subject rights.

  • Types of data processed: Master data (e.g. names, addresses); payment data (e.g. bank details, invoices, payment history); Contract data (e.g. subject matter of the contract, term, customer category); Usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses); contact details (e.g. email, telephone numbers).
  • Data subjects: Customers; prospective customers.
  • Purposes of processing: Provision of contractual services and customer service.
  • Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6( 1(1)(b) of the GDPR).

Further information on processing operations, procedures and services:

  • American Express: payment services (technical integration of online payment methods); Service provider: American Express Europe S.A., Theodor-Heuss-Allee 112, 60486 Frankfurt am Main, Germany; Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1), first sentence, (b) of the GDPR); Website: https://www.americanexpress.com/de; Privacy policy: https://www.americanexpress.com/de/legal/online-datenschutzerklarung.html.
  • Apple Pay: Payment services (technical integration of online payment methods); Service provider: Apple Inc., Infinite Loop, Cupertino, CA 95014, USA; Legal basis: Contract performanceand pre-contractual enquiries (Art. 6(1), first sentence, point (b) of the GDPR); Website: https://www.apple.com/de/apple-pay/; Privacy Policy: https://www.apple.com/legal/privacy/de-ww/.
  • Google Pay: Payment services (technical integration of online payment methods); Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Legal basis: performance of a contract and pre-contractual enquiries (Art. 6(1), first sentence, point (b) of the GDPR); Website: https://pay.google.com/intl/de_de/about/; Privacy policy: https://policies.google.com/privacy.
  • Klarna / Sofortüberweisung: Payment services (technical integration of online payment methods); Service provider: Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden; Legal basis: Performance of a contract and pre-contractual enquiries (Article 6(1)(b) of the GDPR); Website: https://www.klarna.com/de; Privacy policy: https://www.klarna.com/de/datenschutz.
  • Mastercard: Payment services (technical integration of online payment methods); Service provider: Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium; Legal bases: Performance of a contractperformance and pre-contractual enquiries (Art. 6(1), first sentence, point (b) of the GDPR); Website: https://www.mastercard.de/de-de.html; Privacy policy: https://www.mastercard.de/de-de/datenschutz.html.
  • PayPal: payment services (technical integration of online payment methods) (e.g. PayPal, PayPal Plus, Braintree); Service provider: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg; Legal basis: Performance of a contract and pre-contractual enquiries (Article 6(1)(b) of the GDPR); Website: https://www.paypal.com/de; Privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.
  • Shop Pay (Shopify): Payment services (technical integration of online payment methods); Service provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland; Legal basis: Performance of a contract and pre-contractual enquiries (Art. 6(1)(b) GDPR); Website: https://www.shopify.de; Privacy policy: https://www.shopify.de/legal/datenschutz.
  • Visa: Payment services (technical integration of online payment methods); Service provider: Visa Europe Services Inc., London Branch, 1 Sheldon Square, London W2 6TT, UK; Legal basis: Performance of a contractand pre-contractual enquiries (Art. 6(1), first sentence, point (b) of the GDPR); Website: https://www.visa.de; Privacy policy: https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html.

Provision of the online service and web hosting

We process users’ data in order to provide them with our online services. For this purpose, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or end device.

  • Types of data processed: Usage data (e.g. webpages visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses); content data (e.g. entries in online forms); master data (e.g. names, addresses); payment data (e.g. bank details, invoices, payment history); contact details (e.g. email, telephone numbers); contractual data (e.g. subject matter of the contract, term, customer category).
  • Data subjects: Users (e.g. website visitors, users of online services); customers.
  • Purposes of processing: Provision of our online services and user-friendliness; IT infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)); security measures; provision of contractual services and customer service.
  • Legal bases: Legitimate interests (Art. 6(1) (1)(f) of the GDPR).

Further information on processing operations, procedures and services:

  • Provision of online services on rented server space: To provide our online service, we use storage space, computing capacity and software which we rent or otherwise obtain from a relevant server provider (also known as a ‘web host’); Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR).
  • Collection of access data and log files: Access to our online services is logged in the form of so-called ‘server log files’. Server log files may include the address and name of the web pages and files accessed, the date and time of access, the volume of data transferred, a confirmation of successful access, browser type and version, the user’s operating system, the referrer URL (the page visited previously) and, as a rule, IP addresses and the requesting provider. The server log files maybe used, on the one hand, for security purposes, e.g. to prevent server overload (particularly in the event of malicious attacks, so-called DDoS attacks) and, on the other hand, to ensure server capacity utilisation and stability; Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); Deletion of data: Log file information is stored for a maximum of 30 days and is then deletedor anonymised. Data which must be retained for evidential purposes is exempt from deletion until the respective incident has been definitively resolved.
  • Email dispatch and -hosting: The web hosting services we use also include the sending, receiving and storage of emails. For these purposes, the addresses of the recipients and senders, as well as further information relating to email transmission (e.g. the providers involved) and the contents of the respective emails. The aforementioned data may also be processed for the purpose of detecting spam. Please note that emails are generally not sent in encrypted form. Whilst emails are usually encrypted during transmission, but (unless a so-called end-to-end encryption method is used) not on the servers from which they are sent and received. Wetherefore accept no responsibility for the transmission of emails between the sender and their receipt on our server; Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR).
  • Content Delivery Network: We use a ‘Content Delivery Network’ (CDN). A CDN is a service that enables the content of an online offering, in particular large media files such as graphics or programme scripts, can be delivered more quickly and securely via regionally distributed servers connected via the internet; Legal basis: Legitimate interests (Art. 6(1), first sentence, (f) of the GDPR).
  • Domain technology: Services relating to the provision of IT infrastructure and associated services (e.g. storage space and/or computing capacity); Service provider: Ledl.net GmbH, Lederergasse 6, 5204 Strasswalchen, Austria; Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); Website: www.domaintechnik.at; Privacy policy: https://www.domaintechnik.at/datenschutzerklaerung.html; Data Processing Agreement: Provided by the service provider.
  • Shopify: Platform via which e-commerce services are offered and operatedoperated. The services and the processes carried out in connection with them include, in particular, online shops, websites, their offers and content, community features, purchase and payment transactions, customer communication, and analysis and marketing; Service Provider: Shopify International Limited, Victoria Buildings, 2nd Floor, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland; Legal basis: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); Website: https://www.shopify.de; Privacy policy: https://www.shopify.de/legal/datenschutz.

Specific information regarding applications (apps)

We process the data of users of our application to the extent that this is necessary to provide users with the application and its functionalities, to monitor its security and to further develop it. We mayfurther contact users in accordance with legal requirements, provided that such communication is necessary for the administration or use of the application. For all other matters relating to the processing of user data, please refer to the data protection information contained in this privacy policy.

Legal bases: The processing of data that isis necessary for the provision of the application’s functions serves to fulfil contractual obligations. This also applies where the provision of the functions requires authorisation from the user (e.g. authorisation of device functions). Where the processing of data is not necessary for the provision of the application’s functions but serves the security of the application or our business interests (e.g. the collection of data for the purposes of optimising the application or for security purposes), it is carried out on the basis of our legitimate interests. Where users are expressly asked to give their consent to the processing of their data, the data covered by that consent is processed on the basis of consent.

  • Types of data processed: Personal data (e.g. names, addresses); meta/communication data (e.g. device information, IP addresses); payment data (e.g. bank details, invoices, payment history); contract data (e.g. subject matter of the contract, term, customer category); location data (details of the geographical position of a deviceor a person).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Provision of contractual services and customer service.
  • Legal basis: Consent (Article 6(1), first sentence, point (a) of the GDPR); performance of a contract and pre-contractual enquiries (Art. 6(1), first sentence, point (b) of the GDPR); legitimate interests (Art. 6(1), first sentence, point ( f) of the GDPR).

Further information on processing operations, procedures and services:

  • Commercial use: We process the data of users of our application, registered users and any trial users(hereinafter collectively referred to as “users”) in order to provide them with our contractual services and, on the basis of legitimate interests, to ensure the security of our applicationand to further develop it. The necessary details are identified as such within the context of the conclusion of the user agreement, contract, orderor comparable contracts, and may include the details required for the provision of services and any invoicing, as well as contact information to enable the resolution of any R&; Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1), first sentence, point (b) GDPR).
  • Device permissions for access to functions and data: The use of our application or its functionalitymay require users to grant permissions to access certain functions of the devices used or to the data stored on the devices or accessible via them. By default, these permissions must be granted by users and can be revoked at any time in the settings of the respective devices. The exact procedure for managing app permissions may vary depending on the deviceand the software used by the user. Users may contact us if they require further clarification. We would like to point out that refusing or revoking the relevant permissions may affect the functionality of our application.
  • Processing of location data: When using our application, the location data collected by the device being used or otherwise entered by users. The use of location data requires the user’s consent, which may be withdrawn at any time. The use of location data serves solely to provide the relevant functionality of our application, in accordance with its description to users or its typical and expected mode of operation.
  • No location history and no movement profiles: Location data is used only on an ad hoc basis and is not used to create a location history or a movement profile of the devices used, or their users.

Obtaining applications via app stores

Our application is obtained via special online platforms operated by other service providers (so-called “app stores”). In this context, the privacy policies of the respective app stores apply in addition to our privacy policy. This applies in particular with regard to the procedures used on the platforms for audience measurement and interest-based marketing, as well as any associated costs.

  • Types of data processed: Personal details (e.g. names, addresses); payment details (e.g. bank details, invoices, payment history); contact details (e.g. email, telephone numbers); Contract data (e.g. subject matter of the contract, term, customer category); usage data (e.g. websites visited, interest in content, access times); Meta/communication data (e.g. device information, IP addresses); content data (e.g. entries in online forms).
  • Data subjects: Customers; users (e.g. website visitors, users of online services).
  • Purposes of processing: Provision of contractual services and customer service; Marketing.
  • Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR).

Further information on processing operations, procedures and services:

Registration, login and user account

Users may create a user account. As part of the registration process, users are informed of the required mandatory details, which are processed for the purposes of providing the user account on the basis of contractual obligations. The data processed includes, in particular, login details (username, password and an email address).

When using our registrationand login functions, as well as when using the user account, we store the IP address and the time of the respective user action. This storage is carried out on the basis of our legitimate interests, as well as those of the users, in protection against misuse and other unauthorised use. This data is not disclosed to third partiesunless it is necessary to pursue our claims or there is a legal obligation to do so.

Users maybe informed by email about events relevant to their user account, such as technical changes.

  • Types of data processed: Master data (e.g. names, addresses); contact details (e.g. email, telephone numbers); content data (e.g. entries in online forms); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Provision of contractual services and customer service; security measures; management and response to enquiries; provision of our online services and user-friendliness.
  • Legal bases: Performance of a contractand pre-contractual enquiries (Art. 6(1), first sentence, point (b) of the GDPR); Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR).

Further information on processing operations, procedures and services:

  • Registration using real names: Due to the nature of our community, we ask users to use our service only under their real names. This means that the use of pseudonyms is not permitted; Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1), sentence 1(b) of the GDPR).
  • Deletion of data following termination: Once users have terminated their user account, their data relating to that account will be deleted, subject to any statutory authorisation, obligation orconsent, Legal bases: Performance of a contract and pre-contractual enquiries (Art. 6(1), sentence 1, point (b) GDPR).
  • No obligation to retain data: It is the users’ responsibility to back up their data prior to the end of the contract following termination. We are entitled to irrevocably delete all user data stored during the term of the contract; Legal bases: Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) of the GDPR).

Blogs and publication media

We use blogs or similar means of online communication and publication (hereinafter ‘publication media’). Readers’ data is processedprocessed for the purposes of the publication medium only to the extent necessary for its presentation and for communication between authors and readers, or for security reasons. Furthermore, we refer you to the information regarding the processing of visitors to our publication media within the scope of this privacy policy.

  • Types of data processed: Master data (e.g. names, addresses); contact details (e.g. email, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing: Provision of contractual services and customer service; feedback (e.g. collection of feedback via online forms); provision of our online offering and user-friendliness; security measures; management and response to enquiries.
  • Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR).

Further information on processing operations, procedures and services:

  • Comments and posts: When users leave comments or other posts, their IP addresses may be stored on the basis of our legitimate interests. This is done for our security in the event that someone posts unlawful content in comments or posts (

      • Contact and enquiry management

      When you contact us (e.g. via the contact form, email, telephone or via social media) and within the context of existing user and business relationships, the details of the enquirers are processed to the extent necessary to respond to contact enquiries and any requested actions.

      • Types of data processed: Contact details (e.g. email, telephone numbers); Content data (e.g. entries in online forms); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
      • Data subjects: Communication partners.
      • Purposes of processing: Contact enquiries and communication; managing and responding to enquiries; feedback (e.g. collecting feedback via online forms); Provision of our online services and user-friendliness.
      • Legal bases: Legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR); performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) of the GDPR).

      Further information on processing operations, procedures and services:

      • Contact form: When users contact us via our contact form, email or other communication channels, we process the data provided to us in this context in order to deal with the matter raised; Legal bases: performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) of the GDPR), legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).

      Communication via messaging services

      We use messaging services for communication purposes and therefore ask you to take note of the following information regarding the functionalitymessenger services, encryption, the use of communication metadata and your options for objecting.

      You can also contact us via alternative channels, e.g. by telephone or email. Please use the contact details provided to you or those specified within our online service.

      In the case of end-to-end encryption of content (i.e. the content of your message and attachments), we would like to point out that the communication content (i.e.the content of the message and attached images) are encrypted end-to-end. This means that the content of the messages cannot be viewed, not even by the messaging service providers themselves. You should always use an up-to-date version of the messaging app with encryptionto ensure that the message content is encrypted.

      However, we would also like to point out to our communication partners that, whilst the messaging service providers cannot view the content, they can determine whether and when communication partners are communicating with us, as well as technical information about the device used by the communication partners and, depending on their device settings, location information (so-called metadata).

      Notes on legal bases: Where we ask communication partners for their consent before communicating with them via messenger services, the legal basis for our processing of their data is their consent. Furthermore, if we do not ask for consent and they, for example, contact us of their own accord, we use Messenger in our dealings with our contractual partners and as part of the pre-contractual process as a contractual measure; and in the case of other interested parties and communication partners, on the basis of our legitimate interests in rapid and efficient communication and the fulfilment of therequirements of our communication partners regarding communication via Messenger. Furthermore, we would like to point out we do not initially transmit the contact details provided to us to the messaging services without your consent.

      Withdrawal, objection and erasure: You may withdraw any consent you have given at any time and object to communication with us via Messenger at any time. In the case of communication via Messenger, we shall delete the messages in accordance with our general deletion policy (i.e., for example, as described above, upon the termination of contractual relationships, in the context of archiving requirements, etc.) and, in other cases, as soon as we can reasonably assume that we have responded to any enquiries from the communication partners, provided that noreference to a previous conversation and there are no statutory retention obligations preventing the deletion.

      Reservation regarding the use of other communication channels: Finally, we would like to point out that, for reasons ofreserve the right, for reasons of your security, not to respond to enquiries via messaging services. This is the case, for example, where contractual details require special confidentiality or where a reply viavia a messaging service does not meet formal requirements. In such cases, we will direct you to more appropriate channels of communication.

      • Types of data processed: Contact details (e.g. email, telephone numbers); usage data (e.g. websites visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses).
      • Data subjects: Communication partners.
      • Purposes of processing: Contact enquiries and communication; direct marketing (e.g. by email or post).
      • Legal bases: consent (Art. 6(1), first sentence, (a) of the GDPR); legitimate interests (Art. 6(1), first sentence, point (f) of the GDPR).

      Further information on processing operations, procedures and services:

      Push notifications

      With the users’ consent, we may send users so-called ‘push notifications’. These are messages that appear on users’ screens, devices or in their browsers, even when our online service is not currently in active use.

      To subscribe to pushnotifications, users must confirm the prompt from their browser or device to receive push notifications. This consent process is documented and stored. Storage is necessary to determine whether users have consented to receiving pushmessages and to be able to provide evidence of that consent. For these purposes, a pseudonymous identifier for the browser (known as a ‘push token’) or the device ID of an end device is stored.

      Push notifications may, on the one hand, be required for thefulfil contractual obligations (e.g. technical and organisational information relevant to the use of our online service) and are otherwise sent, unless specifically stated below, on the basis of the users’ consent. Users can change their settings for receiving pushmessages at any time via the notification settings of their respective browsers or devices.

      • Types of data processed: Usage data (e.g. webpages visited, interest in content, access times); meta/communication data (e.g. device information, IP addresses); location data (information on the geographical position of a device or a person).
      • Data subjects: Communication partners.
      • Purposes of processing: Provision of our online service and user-friendliness; audience measurement (e.g. access statistics, identification of returning visitors); direct marketing (e.g. by email or post).
      • Legal bases: Consent (Art. 6(1), first sentence, point (a) of the GDPR); performance of a contract and pre-contractual enquiries (Art. 6( 1, sentence 1, point (b) of the GDPR).

      Further information on processing operations, procedures and services:

      • Push notifications containing advertising content: The push notifications we send may contain promotional information. Promotional push notifications are processed on the basis of the user’s consent. Where the content of promotional push notifications is specifically described as part of the consent to receive them, the descriptions shall be decisive for the user’s consent. Furthermore, our newsletters contain information about our services and our organisation; Legal bases: Consent (Art. 6(1), first sentence, point (a) of the GDPR).
      • Location-based sending of push notifications: The push notifications we send may,on the user’s location, based on the location data transmitted by the device being used; Legal basis: Consent (Art. 6(1), first sentence, (a) of the GDPR).
      • Analysis and performance measurement: We analyse push notifications statistically and can thus determine whether and when push notifications have been displayed and clicked on. This information is used to improve our push notifications technically, based on technical data, target groups and their usage behaviour, or the times at which they are accessed. This analysis also includes determining whether the push notifications are opened, when they areare opened, and whether users interact with their content or buttons. For technical reasons, this information may be attributed to individual push notification recipients. However, it is neither our intention nor, where applicable, that of the push notification service provider, to monitor individual users. Rather, the analyses help us to identify our users’ usage habits and to tailor our pushmessages to them or to send different push messages tailored to our users’ interests.

Information on the use of chat and messaging services

WhatsApp Messenger

Where you have given your consent, we process the personal data you have provided or which is available to us (e.g. name, telephone number, email address, Messenger NaMessagingID, profile picture, messages) for the purpose of communicating regarding the preparation and execution of any orders, as well as for sending promotional information (e.g. offers, newsletters) using the instant messaging service ‘WhatsApp’ provided by WhatsApp Ireland Limited, 4 Grand Canal Harbour, Dublin 2, Ireland. Grand Canal Square. An existing messaging account is required to use this service. Please note that WhatsApp Ireland Limited may also pass on personal data (in particular communication metadata) to WhatsApp Inc., which may also be processed on servers in countries outside the EU (e.g. the USA) where there is no adequate level of data protection. WhatsApp may share this data with other companies within and outside the Facebook Group. Further information can be found in the privacy policy of WhatsApp Business ( https://www.whatsapp.com/legal/businesspolicy/ ) and WhatsApp ( https://www.whatsapp.com/legal/#privacypolicy). We have neither precise knowledge of nor any influence over the data processing carried out by WhatsApp Ireland Limited, which is the data controller under data protection law. ed or WhatsApp Inc., which, in this respect, In addition to the recipients specifically named above, we use the services of other service providers (data processors) to fulfil our obligations. Please note that you may withdraw your consent at any time with future effect without giving reasons, by notifying us of your withdrawal via WhatsApp with a message containing the word ‘WITHDRAWAL’ or by email to the email address specified in this privacy policy or our legal notice regarding the relevant processing of your personal data. The data mentioned above will be deleted by us in accordance with legal requirements as soon as the consent permitting its processing is withdrawn, or when the purpose for which the data is processed no longer applies, or when it is no longer necessary for that purpose. If the data is not deleted because it is required for other, legally permissible purposes, its processing will be restricted to those purposes. This means that the data will be blocked and not processed for any other purposes. This applies, for example, to data which must be retained for commercial or tax law reasons, or where storage is necessary to establish, exercise or defend legal claims, or to protect the rights of another natural or legal person.


Web chat on mittersill.info
Mittersill Plus GmbH uses a web chat on the website mittersill.info. The web chat serves as an additional means of communication on our website and enables online conversations with Mittersill Plus GmbH. The conversation is conducted via a chatbot (virtual assistant, software), which answers users’ questions, assists with your enquiry or provides you with information.

What personal data is processed?
When you use the web chat, the following personal data is processed and stored:
• Date and time of the session,
• IP address,
• URL of the previously visited website,
• First name
• Surname
• Email address
• Chat ID and user token (stored in the browser’s local storage)

Depending on the course of the conversation with our chatbot, we may process further data from you, provided you supply it during the conversation, depending on your enquiry or the issue you describe to us. Use of the web chat is voluntary and your data will only be processed in this instance.

For what purposes and on what legal basis is the data processed?
We use the data mentioned above to provide the web chat service, to address users personally, to respond to user enquiries and to provide users with information and/or content. Legal basis: Our legitimate interest in providing a web chat service (Article 6(1)(f) of the GDPR).
How long is personal data stored?
12 months

To whom is data disclosed?
Data is disclosed to third parties solely for the purpose of fulfilling our business obligations, in order to process and respond to your enquiry. For this purpose, your data will be passed on to Inbox Solutions GmbH (Pretzfelder Straße 7 – 11, 90425 Nuremberg, Germany) as the technical operator of the web chat, and to Sellwerk GmbH & Co. KG (Pretzfelder Straße 7 – 11, 90425 Nuremberg, Germany) as an intermediary to the company, and to the company you have contacted via the web chat. We use Google Cloud to store your data and chat histories. The data is transferred to and stored on servers located in Frankfurt. Google does not use this data for its own purposes. We use Google Cloud services on the basis of our legitimate interest pursuant to Article 6(1)(f) of the GDPR, in order to be able to provide our services via the technical infrastructure. We have entered into a data processing agreement with Google (https://cloud.google.com/terms/data-processing-terms). In the event that personal data is transferred to the USA, we have entered into EU Standard Contractual Clauses with Google (https://cloud.google.com/terms/data-processing-terms). The EU Standard Contractual Clauses are a generally recognised mechanism for the lawful cross-border transfer of personal data to countries outside the European Economic Area (EEA).

Further information on using the web chat
When you visit the website mittersill.info, the chat widget is loaded as a JavaScript file. No data is transferred before you open the chat. You have two options for opening the web chat:
1. Manually click on the button in the directory listing
2. Manually click on the chat icon at the bottom right of the website

The moment you open the web chat, your chat is created as an object in the background, and the chat ID and a token are stored in the browser’s local storage. The ID and token are unique identifiers that enable us to unambiguously recognise your chat (chat ID) and you as a user (token) even when you visit again, and to display any previous chat history. As soon as you return to our website, the chat history is restored using the data stored in local storage. You must open the chat manually. In addition, the history of the web chats is stored. Every message you send is saved. This is to ensure that your chat history can still be displayed even if the conversation is resumed at a later time, for example, if a company replies to you with a delay. If a company contacts you and you are no longer online, you will receive a link via email that takes you back to the chat so that you can continue communicating with the company there. When you click on the link in your email, the chat will open automatically. You can pause the chat at any time; however, your data will not be automatically deleted in this case. If you no longer wish to receive messages from the company (opt-out), simply send the message ‘Stop’ via the web chat. After that, you will no longer receive messages from the company via the chat, nor will you be contacted by email. Your chat history and data will be automatically deleted 6 months after the ‘Stop’ message. To have your data deleted immediately, please send an email to support@chatwerk.de. Your data and saved chat histories will then be deleted immediately.

Data controller for the Facebook Messenger service:
Facebook Messenger, Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA; the privacy policy is available at facebook.com/about/privacy

Provider responsible for the WhatsApp Messenger service:
WhatsApp Messenger, WhatsApp, Inc., 1601 Willow Road, Menlo Park, California 94025, USA; the privacy policy is available at whatsapp.com/legal/business-policy/

The data controller for the Instagram Direct Messages service:
Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; the privacy policy is available at https://help.instagr am.com/519522125107875

Provider responsible for the ChatWerk platform/service:
Inbox Solutions GmbH, Pretzfelder Straße 7. The privacy policy is available at 11, 90425 Nuremberg, Germany. https://chatwerk.de/datenschutzerklaerung/
Data transfer to Salzburgerland Tourismus GmbH

On this website, subject to your consent, data relating to your use of individual parts of the website is transferred to Salzburgerland Tourismus GmbH, Wiener Bundesstraße 23, 5300 Hallwang (https://www.salzburgerland.com). In doing so, data relating to the use of this website is processed for the purposes of analysis and online marketing, including the display of personalised advertising on other websites. This processing continues until consent is withdrawn or the respective cookie retention period expires. Further information on data protection at Salzburgerland Tourismus GmbH can be found at https://www.salzburgerland.com/de/impressum-und-datenschutz/.

Our partners & awards

Stay informed